Skills asset-creator

📦

asset-creator

Name: asset-creator
Author: AayushBaniya2006

Content revision r1 High Risk 🔑 Env variables⚙️ External commands📁 Filesystem access

Generate AI Product Assets

Teams need consistent visual assets for product pages, docs, and marketing screens. This skill guides DALL-E generation and stores files in project asset folders.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "asset-creator" from https://skillstore.io/skills/aayushbaniya2006-asset-creator.md and its manifest at https://skillstore.io/api/skills/aayushbaniya2006-asset-creator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/aayushbaniya2006-asset-creator.md Signed manifest GET /api/skills/aayushbaniya2006-asset-creator/manifest Signed lockfile GET /api/skills/aayushbaniya2006-asset-creator/lockfile

Test it

Using "asset-creator". A request for a hero image of a futuristic dashboard on a laptop screen.

Expected outcome:

The skill runs the helper script with a detailed DALL-E prompt and saves hero-dashboard.png under the selected public asset folder.

Using "asset-creator". A request for a documentation image about setting up an API key.

Expected outcome:

The skill creates a minimalist setup illustration and reports the saved file path for use in project content.

Using "asset-creator". A request for a feature illustration with natural styling.

Expected outcome:

The skill passes the natural style option to the image generator and stores a PNG with the requested filename.

Security Audit

High Risk

v9 • 7/5/2026 Open versioned report

Most static detections are false positives caused by Markdown backticks, JavaScript template literals, and expected OpenAI API key handling. Real risk remains in the helper script because user-supplied folder and filename values can influence directory creation and file writes without path allowlisting.

Files scanned

152

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

scripts/generate-image.ts:7-11 scripts/generate-image.ts:62-70

Path Traversal in Asset Output Path

The script accepts folder and filename strings with only non-empty validation, then joins them into a filesystem path and writes the generated PNG. Relative path segments could write outside the intended public asset directory.

The validation schema only requires non-empty strings for filename and folder, and the write path is built directly from those values. The writeFileSync call confirms the user-controlled path reaches a filesystem write.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/generate-image.ts:64

Node.js fs operations

fs.mkdirSync(publicDir, { recursive: true });

The script creates a directory using a path derived from user-supplied folder input. Without path normalization checks, this can create directories outside the intended public asset area.

Medium

scripts/generate-image.ts:70

Node.js fs operations

fs.writeFileSync(fullPath, buffer);

The script writes image bytes to a path derived from user-supplied folder and filename input. This is a real filesystem write surface that can overwrite or create files if paths are unsafe.

Medium

scripts/generate-image.ts:70

Synchronous file operations

fs.writeFileSync(fullPath, buffer);

The synchronous write operation persists generated data to a user-influenced path. The main risk is the unbounded output path, not the synchronous API alone.

Medium

SKILL.md:21-23

Ruby/shell backtick execution

```bash

The fenced block contains an npx tsx command that runs the helper script. This is expected for the skill, but it is a real external command execution requirement.

Medium

SKILL.md:32-34

Ruby/shell backtick execution

```bash

The fenced example contains an npx tsx command that executes the helper script with user-facing arguments. This is a real external command pattern, though it is documented as intended use.

Medium

SKILL.md:34-40

Ruby/shell backtick execution

```

The surrounding workflow instructs the agent to run the helper script. This confirms external command use, although the exact flagged line is mostly Markdown structure.

Low

scripts/generate-image.ts:63

Node.js fs stat operations

if (!fs.existsSync(publicDir)) {

The existence check uses the same user-influenced output directory as the later write. The check is not dangerous by itself, but it participates in the unsafe path flow.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/aayushbaniya2006-asset-creator/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/aayushbaniya2006-asset-creator/security.svg)](https://skillstore.io/skills/aayushbaniya2006-asset-creator?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/aayushbaniya2006-asset-creator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aayushbaniya2006-asset-creator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/aayushbaniya2006-asset-creator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AayushBaniya2006. (2026). asset-creator security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/aayushbaniya2006-asset-creator/audits/9

BibTeX citation

@techreport{aayushbaniya2006-aayushbaniya2006-asset-creator-2026,
  author = {AayushBaniya2006},
  title = {asset-creator security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/aayushbaniya2006-asset-creator/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "asset-creator security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "AayushBaniya2006"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/aayushbaniya2006-asset-creator/audits/9"
identifiers:
  - type: other
    value: "skillstore:aayushbaniya2006-asset-creator:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Marketing Illustrations

Generate hero images, product illustrations, and campaign visuals that match a clean SaaS style.

Add Documentation Visuals

Create simple diagrams or screen-inspired visuals for guides, tutorials, and release pages.

Prototype Product Imagery

Produce quick concept assets for product pages before commissioning final design work.

Try These Prompts

Basic Product Illustration

Create an image for a modern SaaS dashboard showing clean analytics charts. Save it as dashboard-hero in assets/marketing using natural style.

Consistent Feature Visual

Generate a flat illustration for an automated invoice review feature. Use a white background, blue and green accents, and save it as invoice-review in assets/features.

Documentation Support Image

Create a clean tutorial image showing a user connecting an API key to a workspace. Use minimalist vector styling and save it as api-key-setup in assets/docs.

Advanced Campaign Set

Design three coordinated prompts for a launch page about AI budgeting. Generate the strongest hero asset first, then save it as ai-budgeting-hero in assets/campaigns using vivid style.

Best Practices

Use descriptive prompts that include subject, composition, style, and background.
Keep generated files in a small set of reviewed public asset folders.
Review each generated image before publishing it in customer-facing content.

Avoid

Do not include secrets, private user data, or unreleased screenshots in prompts.
Do not use folder or filename values that contain relative path segments.
Do not publish generated images without checking brand fit and licensing requirements.

Frequently Asked Questions

What does this skill generate?

It generates image assets such as illustrations, hero visuals, and product-themed graphics using OpenAI DALL-E 3.

Does it require external credentials?

Yes. The helper script requires an OPENAI_API_KEY environment variable before it can request images.

Where are generated files saved?

The script saves PNG files under a public folder path chosen through the folder argument.

Can it create transparent images?

It requests transparent or white backgrounds, but the script does not perform transparency cleanup after generation.

Is it safe for private data?

Prompts are sent to OpenAI, so users should avoid private data, secrets, and confidential product details.

Does it work with Claude, Codex, and Claude Code?

The report declares support for Claude, Codex, and Claude Code workflows that can run the helper script.

Developer Details

Author

AayushBaniya2006

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/AayushBaniya2006/blinkfund/tree/main/.claude/skills/asset-creator/

Ref

a29db30e42179ff8ed4d95c9dfba3704c22643d0

Maintenance freshness

7/18/2026

Usage

19 downloads · 200 views

File structure

📁 scripts/

📄 generate-image.ts

📄 reference.md

📄 SKILL.md

asset-creator

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (1)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Create Marketing Illustrations

Add Documentation Visuals

Prototype Product Imagery

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details